Most probable cause determination for telecommunication events

Abstract

A method performed by a computing system includes collecting information on transactions in a telecommunication system, using the information on transactions to create a plurality of event objects, each of the event objects associated with a telecommunication event, associating each of the event objects with a Key Performance Indicator (KPI), applying the event objects to a plurality of inference functions, each inference functions using the set of parameters as inputs and the KPIs of the event objects as outputs to create a model that infers a relationship between the set of parameters and the KPIs, and analyzing metadata from each of the inference functions to determine which of the set of parameters was used to predict an outcome leading to the KPI.

What is claimed is: 
     
       1. A method performed by a computing system, the method comprising:
 collecting information on transactions in a telecommunication system, including digests of data packets from a core network and a radio access network of the telecommunications system and information from user devices interacting with the telecommunication system; 
 using the information on transactions to create a plurality of event objects by correlating the information on transactions between a user plane tunnel and a control plane, each of the event objects associated with a telecommunication failure event, and the event objects including a set of parameters based on the information on transactions; 
 associating parameters of the set of parameters of each of the event objects with at least one Key Performance Indicator (KPI); 
 applying the event objects to a plurality of machine-learning inference functions, each of the inference functions using the set of parameters as inputs and at least one KPI of the event objects as outputs; 
 analyzing metadata from each of the plurality of machine-learning inference functions to determine a first parameter of the set of parameters was used to predict an outcome associated with the at least one KPI, including scoring input field occurrences of the parameters of the set of parameters across the inference functions, the scoring indicating a respective relationship between each one of the input field occurrences and the at least one KPI, and determining that the first parameter of the set of parameters is a most probable cause of the at least one KPI based on the scoring; 
 applying additional event objects to the plurality of machine-learning inference functions in response to determining that a confidence score associated with the most probable cause is below a threshold; and 
 addressing the most probable cause, including mitigating a network failure associated with the most probable cause. 
 
     
     
       2. The method of  claim 1 , wherein the computing system may use a rules table to associate an event object with a KPI. 
     
     
       3. The method of  claim 1 , wherein the outputs for the inference functions may further include additional information from the plurality of event objects or transformations to further classify outcomes. 
     
     
       4. The method of  claim 1 , wherein the at least one KPI includes at least one of: successful call attempt, failed call attempt, dropped call, media failure, successful registration, failed registration, inter-working success, and inter-working failure. 
     
     
       5. The method of  claim 1 , wherein the set of parameters for a specific event object include at least one of the following associated with the telecommunication failure event for the specific event object: gateways involved, cluster, device model, device manufacturer, multimedia server, and media type. 
     
     
       6. The method of  claim 1 , wherein the inference functions include at least two of: a naive Bayes function, a generalization function, a deep learning function, a decision tree function, a random forest function and a gradient boost function. 
     
     
       7. The method of  claim 1 , wherein the plurality of inference functions include automatic variations of the at least one KPI based on protocol or domain-specific knowledge of underlying failures. 
     
     
       8. The method of  claim 1 , wherein the computing system collects data being transmitted between a Radio Access Network (RAN) and a Mobility Management Element (MME). 
     
     
       9. The method of  claim 1 , wherein the computing system collects data being transmitted between a Radio Access Network (RAN) and a Serving Gateway (SGW). 
     
     
       10. The method of  claim 1 , further comprising, reducing a number of event objects before passing the event objects through the inference functions. 
     
     
       11. The method of  claim 10 , wherein reducing the number of event objects includes:
 determining a top n types for a specific input parameter associated with a specific KPI; and 
 using only the top n types for passing through the inference functions. 
 
     
     
       12. The method of  claim 1 , further comprising, presenting parameter information in a prioritized order from most-likely to least-likely of reasons for a particular KPI failure. 
     
     
       13. A system comprising:
 a processor; and 
 a memory having machine readable instructions that when executed by the processor, cause the system to: 
 collect information on transactions in a telecommunication system, including digests of data packets from a core network and a radio access network of the telecommunications system and information from user devices interacting with the telecommunication system; 
 use the information on transactions to create a plurality of event objects by correlating the information on transactions between a user plane tunnel and a control plane, each of the event objects associated with a telecommunication failure event, and the event objects including a set of parameters based on the information on transactions; 
 associate parameters of the set of parameters of each of the event objects with at least one Key Performance Indicator (KPI); 
 apply the event objects to a plurality of machine-learning inference functions, each of the inference functions using the set of parameters as inputs and the at least one KPI of the event objects as outputs; 
 analyze metadata from each of the plurality of machine-learning inference functions to determine a first parameter of the set of parameters was used to predict an outcome leading to the at least one KPI, including scoring input field occurrences of the parameters of the set of parameters across the inference functions, the scoring indicating a respective relationship between each one of the input field occurrences and the at least one KPI, and determining that the first parameter of the set of parameters is a most probable cause of the at least one KPI based on the scoring; 
 apply additional event objects to the plurality of machine-learning inference functions in response to determining that a confidence score associated with the most probable cause is below a threshold; and 
 address the most probable cause, including mitigating a network failure associated with the most probable cause. 
 
     
     
       14. The system of  claim 13 , wherein the outputs for the inference functions may further include additional information from the plurality of event objects or transformations to further classify outcomes. 
     
     
       15. The system of  claim 13 , wherein the at least one KPI include at least one of: successful call attempt, failed call attempt, dropped call, media failure, successful registration, failed registration, inter-working success, and inter-working failure. 
     
     
       16. The system of  claim 13 , wherein the set of parameters for a specific event object include at least one of the following associated with the telecommunication failure event for the specific event object: gateways involved, cluster, device model, device manufacturer, multimedia server, and media type. 
     
     
       17. The system of  claim 13 , wherein the inference functions include at least two of: a naive Bayes function, a generalization function, a deep learning function, a decision tree function, a random forest function and a gradient boost function. 
     
     
       18. A computer program product comprising a non-transitory machine-readable medium comprising computer program code for execution by a processor, the computer program product comprising:
 computer program code to collect information on transactions in a telecommunication system, including digests of data packets from a core network and a radio access network of the telecommunications system and information from user devices interacting with the telecommunication system; 
 computer program code to use the information on transactions to create a plurality of event objects by correlating the information on transactions between a user plane tunnel and a control plane, each of the event objects associated with a telecommunication failure event, and the event objects including a set of parameters based on the information on transactions; 
 computer program code to associate parameters of the set of parameters of each of the event objects with at least one Key Performance Indicator (KPI); 
 computer program code to apply the event objects to a plurality of machine-learning inference functions, each of the inference functions using the set of parameters as inputs and the at least one KPI of the event objects as outputs; 
 computer program code to analyze metadata from each of the plurality of machine-learning inference functions to determine a first parameter of the set of parameters was used to predict an outcome leading to the at least one KPI, including scoring input field occurrences of the parameters of the set of parameters across the inference functions, the scoring indicating a respective relationship between each one of the input field occurrences and the at least one KPI, and determining that the first parameter of the set of parameters is a most probable cause of the at least one KPI based on the scoring; 
 computer program code to apply additional event objects to the plurality of machine-learning inference functions in response to determining that a confidence score associated with the most probable cause is below a threshold; and 
 computer program code to address the most probable cause, including mitigating a network failure associated with the most probable cause. 
 
     
     
       19. The computer program product of  claim 18 , wherein the inference functions include at least two of: a naive Bayes function, a generalization function, a deep learning function, a decision tree function, a random forest function and a gradient boost function. 
     
     
       20. The computer program product of  claim 18 , further comprising, computer program code to reduce a number of event objects before passing the event objects through the inference functions.